NEW

Start with the pressure: sales, launch, abuse, agents, data, or guardrails

Use the engagement router

Sign in Scope a Launch Review

Scope a Launch Review

Agent Tool Permission Security Analysis

Analyze AI agent tool permissions before they become a security incident.

Deterministic security analysis of AI agent tool configurations. Detects missing approval gates, broad permission scopes, unsafe execution identities, and dangerous side effects.

Analyze Agent Permissions Scope Agent Hardening

DO YOUR AGENTS HAVE TOO MUCH PERMISSION?

15 security rules

Across 6 risk categories covering permission scope, approval gates, side effects, and execution identity.

Structured JSON input

Works with any agent tool configuration format — MCP servers, OpenAI function definitions, or custom schemas.

OWASP LLM06 coverage

Maps findings to Excessive Agency risk category with evidence-ready output.

No LLM calls

Fully deterministic — no AI models involved in the analysis, just rules applied to your config.

Load example:

{
  "id": "unsafe-email-agent",
  "name": "Autonomous Email Agent",
  "agentType": "sales_agent",
  "description": "Sends email to any recipient without approval.",
  "owner": "Sales Ops",
  "executionIdentity": "service_account",
  "tools": [
    {
      "id": "email-send",
      "name": "Send Email",
      "toolType": "email",
      "description": "Sends email to any recipient.",
      "requiresApproval": false,
      "executionIdentity": "service_account",
      "permissions": [
        {
          "id": "email-write",
          "permissionType": "send_email",
          "scopeLevel": "external",
          "resource": "any_recipient"
        }
      ],
      "actions": [
        {
          "id": "send",
          "name": "Send",
          "actionType": "send_email",
          "sideEffecting": true,
          "requiresApproval": false,
          "riskLevel": "high"
        }
      ],
      "sideEffects": [
        {
          "id": "external-email",
          "sideEffectType": "external_email",
          "external": true,
          "reversible": false,
          "requiresApproval": false
        }
      ]
    }
  ]
}

SECENG WORKBENCH

Ready to put SecEng Agent Permission Analyzer to work?

Scope a Workbench-backed review — we'll map the AI surfaces, identify the highest-priority gaps, and give you clear findings before any larger commitment.

Start No-Cost Scoping See the full Workbench

Also in the Workbench

WHAT AI DO WE HAVE?

SecEng Surface Scanner

Browser, repo & IDE discovery for AI assets, vendors, and risky patterns.

WHERE CAN AI CODE BECOME AN ATTACK PATH?

SecEng Code Scanner

AI-native SAST and marketplace readiness for AI-enabled apps, agents, integrations, and managed packages.

WHAT DID IT ACTUALLY DO?

SecEng Runtime Proxy

MITM capture, replay & runtime evidence reconstruction.

HOW CAN IT FAIL UNDER ATTACK?

SecEng Adversarial Range

Scenario-driven AI red-team testing for prompts, agents, tools, RAG, and multimodal systems.

WHAT CAN AGENTS ACTUALLY DO?

SecEng Authority Graph

Agent authority, tool permissions, approval paths & delegated-action risk.

WAS RETRIEVAL AUTHORIZED?

SecEng RAG Test Harness

Test retrieval security & context authorization.

WHERE ARE THE TRUST BOUNDARIES?

SecEng Threat Canvas

Structured AI threat modeling, trust-boundary mapping, and abuse-path planning.

WHAT DO OUR PUBLIC AI CLAIMS REVEAL?

SecEng Trust Scanner

Public trust surface scoring across six AI governance dimensions.

WHERE DO TRUST BOUNDARIES LIVE IN JIRA?

Atlassian Threat Canvas

AI threat models that ship to Jira and Confluence.

WHAT'S INSIDE YOUR AI ARTIFACTS?

SecEng Artifact Analyzer

Static artifact intelligence for AI security and evidence packaging.

HOW RESILIENT IS YOUR SYSTEM TO INJECTION?

SecEng Injection Harness

Structured prompt injection probes with evidence session export.

ARE YOUR PROMPTS SECURE?

SecEng Prompt Reviewer

Deterministic rule-based scanner for system prompts and RAG corpus documents.

WHO CONTROLS WHAT MODELS CAN DO?

SecEng Model Gateway

Governed AI routing, policy enforcement, and spend control.

WHAT DOES YOUR AI SECURITY PROGRAM LOOK LIKE?

SecEng Program Blueprint Kit

Complete AI security program structure for Jira, Confluence, and Linear.

IS YOUR MODEL OUTPUT SAFE TO RENDER?

SecEng Output Safety Tester

Deterministic AI output safety analysis across 8 sink types.

WHERE DOES YOUR PROGRAM STAND?

AI Security Program Scorecard

14-domain AI product security baseline with evidence pack generation.

WHAT CAN YOUR AI TOOLS REALLY DO?

SecEng Tool Capsule Analyzer

Analyze MCP servers, OpenAPI specifications, and AI tool definitions to understand capabilities, permissions, and attack surface.

WHERE ARE YOUR PRODUCTION PROMPTS?

SecEng Prompt Asset Scanner

Inventory and review system prompts, developer prompts, agent instructions, and prompt templates for security risks.

WHAT CAN YOUR AGENTS ACTUALLY DO?

SecEng Agent Authority Diff

Compare declared permissions with observed capabilities to identify excessive agent privileges and unsafe tool access.

WHICH AI DEPENDENCIES CHANGE RELEASE RISK?

SecEng Supply Chain Scanner

Identify AI-specific dependency, model loader, framework, and supply-chain security risks.

CAN YOU PROVE WHAT YOUR EVALS COVER?

SecEng Eval Coverage Auditor

Measure whether AI security evaluations adequately cover prompt injection, tool abuse, RAG, memory, and other critical attack classes.

ARE YOUR AI CONFIGS SAFE TO DEPLOY?

SecEng AI Config Linter

Identify AI-specific dependency, model loader, framework, and supply-chain security risks.

CAN YOU PROVE WHAT YOU'VE DONE?

SecEng Evidence Packs

Buyer-ready evidence artifacts from AI security assessment and testing.

See full Workbench